pulumi/pulumi · error

getting secrets manager for stack %q: %w

Error message

getting secrets manager for stack %q: %w

What it means

Wraps a failure from secretsManagerFromStack during `pulumi logs --decrypt` (pkg/cmd/pulumi/logs/decrypt.go:157). After the stack is loaded, its secrets manager must be constructed to get a decrypter for the encrypted log; failures here are typically about secrets provider configuration or credentials rather than the log file itself.

Source

Thrown at pkg/cmd/pulumi/logs/decrypt.go:157

		stackName = stackNameFromFilename(filepath.Base(f.Name()))
	}
	if stackName == "" {
		return fmt.Errorf("cannot determine stack from filename %q; use --stack to specify", filepath.Base(f.Name()))
	}

	opts := display.Options{Color: cmdutil.GetGlobalColorization()}
	s, err := cmdStack.RequireStack(
		ctx, cmdutil.Diag(), ws,
		cmdBackend.DefaultLoginManager,
		stackName, cmdStack.LoadOnly, opts, "",
	)
	if err != nil {
		return fmt.Errorf("loading stack %q for decryption: %w", stackName, err)
	}

	sm, err := secretsManagerFromStack(ctx, s)
	if err != nil {
		return fmt.Errorf("getting secrets manager for stack %q: %w", stackName, err)
	}

	reader, err := encryptedlog.NewReader(ctx, f, sm.Decrypter())
	if err != nil {
		return fmt.Errorf("decrypting log: %w", err)
	}

	return formatLogRecords(reader, out, false)
}

// stackNameFromFilename extracts the stack name from a log filename.
// Files are named "<stack>-<timestamp>[-<updateid>].log" where "/" in
// stack names is replaced with "+".
func stackNameFromFilename(name string) string {
	loc := logTimestampRe.FindStringIndex(name)
	if loc == nil {
		return ""
	}

View on GitHub (pinned to 793f7b2e16)

Solutions

1. For passphrase stacks, export the same passphrase used to create the stack: `export PULUMI_CONFIG_PASSPHRASE=...` (or pass --password where supported) and retry
2. For cloud key providers (AWS KMS, Azure Key Vault, GCP KMS), refresh credentials (`aws login`/`az login`/gcloud auth) and verify IAM permissions on the key
3. For the pulumi.com secrets provider, ensure a valid `pulumi login` and PULUMI_ACCESS_TOKEN with access to the stack's organization
4. Inspect `config.secretsprovider` in Pulumi.<stack>.yaml and correct malformed or moved key references; test decryption with `pulumi config get <key> --show-secrets`

Example fix

// before
$ pulumi logs --decrypt   # passphrase stack, no passphrase in env
// after
$ export PULUMI_CONFIG_PASSPHRASE='same-passphrase-as-stack'
$ pulumi logs --decrypt --stack myorg/myproject/dev

pulumi config get someSecretKey --show-secrets --stack org/proj/dev \
  || { echo 'secrets manager unavailable; check passphrase/KMS credentials'; exit 1; }
pulumi logs --decrypt --stack org/proj/dev

// shell
if ! pulumi logs --decrypt "$LOG" --stack "$STACK" 2>err.txt; then
  grep -q 'getting secrets manager' err.txt && \
    echo 'Fix secrets config: set PULUMI_CONFIG_PASSPHRASE or refresh cloud KMS credentials' >&2
  exit 1
fi

When it happens

Trigger: The stack uses a cloud secrets provider whose credentials are missing or wrong (PULUMI_CONFIG_PASSPHRASE unset for passphrase stacks, missing PULUMI_ACCESS_TOKEN for the pulumi.com provider, absent KMS/Azure Key Vault/GCP KMS credentials or roles, unreadable/wrong --secrets-provider key), or the stack's secrets provider configuration in Pulumi.<stack>.yaml is malformed.

Common situations: Decrypting logs in CI where PULUMI_CONFIG_PASSPHRASE is not exported; switching machines without copying the passphrase; IAM changes removing access to a cloud KMS key; hand-edited secretsprovider settings in the stack config file.

Related errors

• value looks like a secret; rerun with --secret to mark it as
• internal error decoding value; try surrounding the argument
• internal error: marshaling secret: %w
• config value for '%s' looks like a secret; rerun with --secr
• value for --json object key %q is nil

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/7dd7202cb1c3339e. Report an issue: GitHub.